IEC 62443-3-1 Clause 7.3 – Virtual Private Networks (VPNs)

Teaching note: Paraphrased from IEC/TR 62443-3-1:2009 (ISA-TR99.00.01-2007) for learning. The technical report is informational, not a requirements standard. Confirm wording in the published TR. Later normative parts (2-1, 3-3, 4-2) state the shalls.

Technology categories: Overview | Cl. 5 | Cl. 6 | Cl. 7 | Cl. 8 | Cl. 9 | Cl. 10

Clause 7 pages: Cl. 7 | 7.1 Symmetric key | 7.2 Public key | 7.3 VPN

What it is

A virtual private network (VPN) creates an encrypted tunnel across an untrusted network (internet, partner WAN, or wireless backhaul). Common families are IPsec and SSL/TLS VPNs. Use cases: site-to-site links and remote user access to the IACS.

A VPN protects confidentiality and integrity of the tunnel. It is not by itself identification, authorisation, a jump host, or least privilege.

Vulnerabilities addressed

Interception and tampering of traffic that must cross an untrusted network. A VPN does not stop an already-authenticated attacker who is inside the tunnel.

Typical deployment

Site-to-site between plants or between a plant and a data centre.
Remote-access VPN for staff and vendors, preferably landing in a DMZ or on a jump host, not directly on the process LAN.

Known issues and weaknesses

Latency, jitter and reconnect behaviour can disturb control and SCADA sessions.
Split tunnelling and overly broad routes dump remote users onto the process network.
VPN appliances become high-value targets if left unpatched or with default credentials.

Use in IACS

Appropriate for remote and inter-site paths that cannot be physically isolated. Teaching note: TLS-based remote access is now common; the TR’s compatibility-test rule is still the one that prevents production surprises.

Recommendations

Test VPN equipment against the actual IACS traffic (latency, jitter, session reconnect) before production use. Verify that the technology is compatible and does not unacceptably change traffic characteristics.
A VPN is not a substitute for authentication, jump hosts or least privilege. Combine with secure remote access design and 2-1 NET 3.